Microsoft has pressed customers to install its July 2026 updates without delay, following the release of working exploit code for an Active Directory Certificate Services (AD CS) flaw that hands an ordinary domain account the means to impersonate a Domain Controller.
In a post published on X on Jul. 27, Microsoft Threat Intelligence warned that public exploit code “increases the likelihood of exploitation attempts” and told customers to treat the July update as a priority.
The company said it has seen researchers probing the flaw, though nothing it can yet attribute to a real attacker, and has begun circulating detection material for defenders.
Tracked as CVE-2026-54121, the vulnerability was fixed on Jul. 14. Microsoft scored it 8.8 and categorized the underlying weakness as improper authorization. H0j3n and Aniq Fakhrul, who reported it in May and gave it the Certighost name, went public with their analysis and a functioning exploit on Jul. 24.
A Lookup the CA Trusted Too Readily
At issue is a fallback in the AD CS enrollment process called a chase, in which the Certification Authority makes a second directory lookup to resolve a requester’s identity.
The CA would contact whichever host the request nominated, without confirming that host was genuinely a Domain Controller. An attacker able to answer that lookup could hand back identity data belonging to a controller of their choosing, and the CA would build the certificate around it.
Controller accounts carry replication rights over the directory, so a certificate that authenticates as one opens the way to DCSync and the krbtgt secret underpinning domain authentication.
An attacker needed nothing more than a valid domain account and a network path to the CA, with no administrative rights involved and nobody required to click anything.
The researchers’ environment also had an Enterprise CA on the affected code path, the stock Machine template, and the machine account quota left at its default.
What the Patch Changed
July’s update inserts a check before the CA follows a chase: the nominated host must resolve to an actual Domain Controller object in the directory.
However, comparing the June and July binaries, the researchers found the check wrapped in an internal servicing feature gate, with the older code path still present behind it. The researchers did not establish whether that gate is enabled by default on patched systems, and Microsoft’s instruction is simply to apply the update.
Expert Insights has contacted Microsoft to ask whether the validation ships enabled by default, and will update this article with any response.
The CVE had not reached CISA’s Known Exploited Vulnerabilities catalog at the time of writing, and no attack on a real organization has been publicly documented. Still, working exploit code in the open tends to shorten that timeline.
